Aktualizacja: 2025-09-25 14:08:31
This commit is contained in:
@@ -1,4 +1,29 @@
|
|||||||
// BrowserOrchestrator.cpp
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
|
// BrowserOrchestrator.cpp
|
||||||
#include <Windows.h>
|
#include <Windows.h>
|
||||||
#include <Rpc.h>
|
#include <Rpc.h>
|
||||||
#include <iostream>
|
#include <iostream>
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// ControllerBinaryManager.cpp - Fixed compilation issues
|
// ControllerBinaryManager.cpp - Fixed compilation issues
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// ControllerCore.cpp
|
// ControllerCore.cpp
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// ControllerDriverManager.cpp
|
// ControllerDriverManager.cpp
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// ControllerMemoryOperations.cpp
|
// ControllerMemoryOperations.cpp
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "ReportExporter.h"
|
#include "ReportExporter.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// ControllerProcessOperations.cpp
|
// ControllerProcessOperations.cpp
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// ControllerSystemIntegration.cpp
|
// ControllerSystemIntegration.cpp
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "DefenderManager.h"
|
#include "DefenderManager.h"
|
||||||
#include <filesystem>
|
#include <filesystem>
|
||||||
#include <algorithm>
|
#include <algorithm>
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include <windows.h>
|
#include <windows.h>
|
||||||
#include "HelpSystem.h"
|
#include "HelpSystem.h"
|
||||||
#include <iostream>
|
#include <iostream>
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "KeyboardHook.h"
|
#include "KeyboardHook.h"
|
||||||
#include "TrustedInstallerIntegrator.h"
|
#include "TrustedInstallerIntegrator.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
25
kvc/Kvc.cpp
25
kvc/Kvc.cpp
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "DefenderManager.h"
|
#include "DefenderManager.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// KvcDrv.cpp
|
// KvcDrv.cpp
|
||||||
#include "kvcDrv.h"
|
#include "kvcDrv.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// OffsetFinder.cpp
|
// OffsetFinder.cpp
|
||||||
#include "OffsetFinder.h"
|
#include "OffsetFinder.h"
|
||||||
#include "Utils.h"
|
#include "Utils.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// ProcessManager.cpp
|
// ProcessManager.cpp
|
||||||
#include "ProcessManager.h"
|
#include "ProcessManager.h"
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "ReportExporter.h"
|
#include "ReportExporter.h"
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include <filesystem>
|
#include <filesystem>
|
||||||
|
|||||||
@@ -1,4 +1,29 @@
|
|||||||
// SelfLoader.cpp
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
|
// SelfLoader.cpp
|
||||||
#include <windows.h>
|
#include <windows.h>
|
||||||
#include <algorithm>
|
#include <algorithm>
|
||||||
#include <cstring>
|
#include <cstring>
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "ServiceManager.h"
|
#include "ServiceManager.h"
|
||||||
#include "Controller.h"
|
#include "Controller.h"
|
||||||
#include "KeyboardHook.h"
|
#include "KeyboardHook.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
#include "TrustedInstallerIntegrator.h"
|
#include "TrustedInstallerIntegrator.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
#include <tchar.h>
|
#include <tchar.h>
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// Utils.cpp - Fixed compilation issues with NtQuerySystemInformation
|
// Utils.cpp - Fixed compilation issues with NtQuerySystemInformation
|
||||||
#include "Utils.h"
|
#include "Utils.h"
|
||||||
#include "common.h"
|
#include "common.h"
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
//==============================================================================
|
//==============================================================================
|
||||||
// Utils.cpp - System utility functions with modern C++ optimizations
|
// Utils.cpp - System utility functions with modern C++ optimizations
|
||||||
// Enhanced performance, robust error handling, low-level system operations
|
// Enhanced performance, robust error handling, low-level system operations
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// common.cpp - Core system utilities and dynamic API management
|
// common.cpp - Core system utilities and dynamic API management
|
||||||
// Implements service management, system path resolution, and Windows API abstraction
|
// Implements service management, system path resolution, and Windows API abstraction
|
||||||
|
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// kvc_crypt.cpp
|
// kvc_crypt.cpp
|
||||||
#include <Windows.h>
|
#include <Windows.h>
|
||||||
#include <ShlObj.h>
|
#include <ShlObj.h>
|
||||||
|
|||||||
@@ -1,3 +1,28 @@
|
|||||||
|
/*******************************************************************************
|
||||||
|
_ ____ ______
|
||||||
|
| |/ /\ \ / / ___|
|
||||||
|
| ' / \ \ / / |
|
||||||
|
| . \ \ V /| |___
|
||||||
|
|_|\_\ \_/ \____|
|
||||||
|
|
||||||
|
The **Kernel Vulnerability Capabilities (KVC)** framework represents a paradigm shift in Windows security research,
|
||||||
|
offering unprecedented access to modern Windows internals through sophisticated ring-0 operations. Originally conceived
|
||||||
|
as "Kernel Process Control," the framework has evolved to emphasize not just control, but the complete **exploitation
|
||||||
|
of kernel-level primitives** for legitimate security research and penetration testing.
|
||||||
|
|
||||||
|
KVC addresses the critical gap left by traditional forensic tools that have become obsolete in the face of modern Windows
|
||||||
|
security hardening. Where tools like ProcDump and Process Explorer fail against Protected Process Light (PPL) and Antimalware
|
||||||
|
Protected Interface (AMSI) boundaries, KVC succeeds by operating at the kernel level, manipulating the very structures
|
||||||
|
that define these protections.
|
||||||
|
|
||||||
|
-----------------------------------------------------------------------------
|
||||||
|
Author : Marek Wesołowski
|
||||||
|
Email : marek@wesolowski.eu.org
|
||||||
|
Phone : +48 607 440 283 (Tel/WhatsApp)
|
||||||
|
Date : 04-09-2025
|
||||||
|
|
||||||
|
*******************************************************************************/
|
||||||
|
|
||||||
// syscalls.cpp
|
// syscalls.cpp
|
||||||
#include "syscalls.h"
|
#include "syscalls.h"
|
||||||
#include <vector>
|
#include <vector>
|
||||||
|
|||||||
Reference in New Issue
Block a user